[Dovecot] rkhunter alert dovecot using port 1984

Peter Evans peter at ixp.jp
Wed Mar 16 19:06:12 EET 2011


>mailhub:~# netstat -tulnap | grep 2006
>tcp        0      0 10.0.0.24:143           10.0.3.96:2006 ESTABLISHED 
>19372/imap
>This all looks ok - The client should be communcating over a higher port right?

perfectly normal, if your rkhunter is freaking out because its seeing remote 
ports
that it doesn't like, it needs to take some valium. Anything over 1024 is fair 
game
for unprivileged stuff like mail clients.

    P
    on 10.0.0.6 ^^; 



More information about the dovecot mailing list